permdock 0.7.0 → 0.8.0

package/dist/react-native/index.js

@@ -1,24 +1,28 @@
 "use client";
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-DZlnEtLy.js";
-import { n as isThenable } from "../thenable-yD7SabqG.js";
-import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
-import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "../grantee-BrRANrpT.js";
-import { d as resolveActiveTenant } from "../tenancy-CmeBQ6Nv.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-CbGmYiJx.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-Bz469dIh.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-T1Q8X3A2.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-B_poyYvg.js";
-import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DXE3cQYg.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as isThenable } from "../thenable-BNSM1U2R.js";
+import { h as secondsAt, m as rfc3339 } from "../time-nR1JesoH.js";
+import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "../compare-DTfyUunF.js";
+import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-5d1zVBvK.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXlzi69u.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DCakWRsr.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DEiCF4ah.js";
+import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
+import { i as isJws, n as storeOf, r as eventSourceRefresh, t as adapterStore } from "../store-options-Dil3lraY.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BBIT68le.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
-/** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
+/**
+* `true` once the provider has a snapshot to answer from: storage was read or a
+* seed was given. Hide the splash screen on it.
+*/
 function useSnapshotReady() {
 	return usePermDock().status() !== "pending";
 }
@@ -41,6 +45,71 @@ function usePermissionGuard(permission, data) {
 	]);
 }
 //#endregion
+//#region src/react-native/local-assignable.ts
+/**
+* The levels a holder of `level` on `key` may hand out; `undefined` when the
+* table does not know the entry.
+*/
+function entryReach(table, key, level) {
+	const row = Object.hasOwn(table.permissions, key) ? table.permissions[key] : void 0;
+	if (row === void 0) return;
+	if (level === void 0) return row.reach;
+	return row.levelReach !== void 0 && Object.hasOwn(row.levelReach, level) ? row.levelReach[level] : void 0;
+}
+/** The levels a holder of `role`'s included grants on `key` may hand out. */
+function includeReach(table, role, key) {
+	const byKey = table.includeReach !== void 0 && Object.hasOwn(table.includeReach, role) ? table.includeReach[role] : void 0;
+	return byKey !== void 0 && Object.hasOwn(byKey, key) ? byKey[key] : void 0;
+}
+function listOf(record, key) {
+	return record !== void 0 && Object.hasOwn(record, key) ? record[key] ?? [] : [];
+}
+/**
+* What the subject may hand out in `tenant`, by the rules of `assignableIn`:
+* declared assignable roles and the tenant's custom roles, intersected with the
+* permissions and levels the subject holds there. Holding a `meta.manageRoles`
+* role, or an unconditioned allow of a `meta.manageRoles` permission, lifts the
+* intersection.
+*/
+function localAssignableFor(input) {
+	const { rules, custom, tenant, heldNames } = input;
+	const allows = input.held.filter((item) => item.grant.effect === "allow");
+	const heldKeys = new Set(allows.map((item) => item.grant.permission));
+	const unconditioned = (effect, key) => input.held.some(({ grant }) => grant.effect === effect && grant.permission === key && grant.where === void 0 && grant.check === void 0 && grant.approval === void 0 && grant.validity === void 0);
+	const manage = heldNames.some((name) => rules.manage.roles.includes(name)) || rules.manage.permissions.some((key) => unconditioned("allow", key) && !unconditioned("deny", key));
+	const held = new Set(heldNames);
+	const listed = rules.assigns === void 0 ? void 0 : new Set(heldNames.flatMap((name) => listOf(rules.assigns, name)));
+	const roles = rules.roles.filter((item) => {
+		if (manage) return true;
+		if (listed !== void 0) return listed.has(item.name);
+		return held.has(item.name) || item.allows.length > 0 && item.allows.every((key) => heldKeys.has(key));
+	});
+	const permissions = rules.permissions.filter((leaf) => manage || heldKeys.has(leaf.key));
+	const offered = (key) => {
+		const names = listOf(rules.levels, key);
+		if (manage) return names;
+		const reached = new Set(allows.filter((item) => item.grant.permission === key).flatMap((item) => item.reach ?? []));
+		return names.filter((name) => reached.has(name));
+	};
+	const levels = {};
+	for (const leaf of permissions) if (listOf(rules.levels, leaf.key).length > 0) levels[leaf.key] = offered(leaf.key);
+	const assignsAt = manage ? void 0 : new Set(roles.map((item) => item.on));
+	const mayHandOut = (scope, allow) => {
+		const table = Object.hasOwn(custom, scope) ? custom[scope] : void 0;
+		if (table === void 0 || !Object.hasOwn(table.permissions, allow.key) || !(manage || heldKeys.has(allow.key))) return false;
+		if (listOf(rules.levels, allow.key).length === 0) return true;
+		const can = offered(allow.key);
+		return (allow.reach ?? []).every((name) => can.includes(name));
+	};
+	const customNames = input.customRoles.filter((role) => (assignsAt === void 0 || assignsAt.has(role.scope)) && role.allows.length > 0 && role.allows.every((allow) => mayHandOut(role.scope, allow))).toSorted((a, b) => Number(!a.shared) - Number(!b.shared) || byCodePoint(a.name, b.name)).map((role) => role.name);
+	return compact({
+		tenant,
+		roles: [...roles.map((item) => item.name), ...new Set(customNames)],
+		permissions,
+		levels: Object.keys(levels).length === 0 ? void 0 : levels
+	});
+}
+//#endregion
 //#region src/react-native/local.ts
 const CARRIED = /* @__PURE__ */ new Set([
 	"id",
@@ -75,8 +144,8 @@ function renamed(grant, name) {
 	};
 }
 /**
-* The grants a custom role holds, from the entries the server resolved one
-* by one: an entry the table does not know grants nothing.
+* The grants a custom role holds, from the entries the server resolved one by
+* one: an entry the table does not know grants nothing.
 */
 function customGrants(table, role) {
 	const entries = Array.isArray(role.grants) ? role.grants : [];
@@ -102,22 +171,38 @@ function customGrants(table, role) {
 		});
 	}
 	const out = [];
+	const reached = [];
 	const included = /* @__PURE__ */ new Set();
 	const names = Array.isArray(role.includes) ? role.includes : [];
 	for (const name of names) {
 		const list = typeof name === "string" && Object.hasOwn(table.includes, name) ? table.includes[name] : void 0;
 		for (const grant of list ?? []) {
 			if (grant.effect === "deny" || !removed.has(grant.permission)) out.push(grant);
-			if (grant.effect === "allow") included.add(grant.permission);
+			if (grant.effect === "allow") {
+				included.add(grant.permission);
+				if (!removed.has(grant.permission) && typeof name === "string") reached.push({
+					key: grant.permission,
+					reach: includeReach(table, name, grant.permission)
+				});
+			}
 		}
 	}
 	for (const { key, level } of allows) {
 		if (removed.has(key) || included.has(key)) continue;
 		const row = Object.hasOwn(table.permissions, key) ? table.permissions[key] : void 0;
 		const grants = typeof level === "string" ? row?.levels?.[level] : row?.all;
-		out.push(...grants ?? []);
+		if (grants !== void 0 && grants.length > 0) {
+			out.push(...grants);
+			reached.push({
+				key,
+				reach: entryReach(table, key, typeof level === "string" ? level : void 0)
+			});
+		}
 	}
-	return out.map((grant) => renamed(grant, role.name));
+	return {
+		grants: out.map((grant) => renamed(grant, role.name)),
+		allows: reached
+	};
 }
 function isList(value) {
 	return Array.isArray(value);
@@ -158,39 +243,60 @@ function buildLocalSnapshot(manifest, data, at) {
 	const declared = new Set(manifest.roles);
 	const globalRoles = new Set(input?.roles ?? []);
 	const grants = [];
-	const attach = (grant, membership) => {
-		grants.push(bindGrant(membership === void 0 ? grant : {
+	const held = [];
+	const attach = (grant, membership, reach) => {
+		const bound = bindGrant(membership === void 0 ? grant : {
 			...grant,
 			membership
-		}, subject));
+		}, subject);
+		grants.push(bound);
+		if (membership === void 0 || tenantOf$1(membership, scopes) === tenant && !isMembershipExpired(membership, now)) held.push({
+			grant: bound,
+			reach
+		});
 	};
-	for (const grant of manifest.grants) {
+	const grantReach = manifest.assignable?.grants;
+	for (const [index, grant] of manifest.grants.entries()) {
+		const reach = grantReach !== void 0 && Object.hasOwn(grantReach, String(index)) ? grantReach[String(index)] : void 0;
 		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
 		if (roleItems.length > 0 && principal === null) continue;
 		if (!roleItems.every((item) => item.scope !== "global" || declared.has(item.role) && globalRoles.has(item.role))) continue;
 		const scoped = roleItems.filter((item) => item.scope !== "global");
 		if (scoped.length === 0) {
-			attach(grant);
+			attach(grant, void 0, reach);
 			continue;
 		}
-		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership);
+		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership, reach);
 	}
 	const formed = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
 	const sharedNames = new Set(formed.filter((role) => role.shared === true).map((role) => role.name));
 	const custom = formed.filter((role) => role.shared === true || role.scope === "global" || !sharedNames.has(role.name));
+	const tenantCustom = [];
+	const tenantRoles = /* @__PURE__ */ new Set();
 	for (const role of custom) {
 		const scope = customScope(role, scopes);
 		const table = scope !== void 0 && Object.hasOwn(manifest.custom, scope) ? manifest.custom[scope] : void 0;
 		if (scope === void 0 || table === void 0) continue;
-		const resolved = customGrants(table, role);
+		const { grants: resolved, allows } = customGrants(table, role);
+		const reachOf = (permission) => [...new Set(allows.filter((allow) => allow.key === permission).flatMap((allow) => allow.reach ?? []))];
 		if (scope === "global") {
-			if (role.tenant === void 0 && globalRoles.has(role.name)) for (const grant of resolved) attach(grant);
+			if (role.tenant === void 0 && globalRoles.has(role.name)) for (const grant of resolved) attach(grant, void 0, reachOf(grant.permission));
 			continue;
 		}
+		if (tenant !== void 0 && (role.shared === true ? role.tenant === void 0 : role.tenant === tenant) && !tenantRoles.has(role.name)) {
+			tenantRoles.add(role.name);
+			tenantCustom.push({
+				name: role.name,
+				scope,
+				shared: role.shared === true,
+				allows
+			});
+		}
 		const id = role.team ?? role.id;
-		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
+		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership, reachOf(grant.permission));
 	}
 	const roles = subject.principal === null ? [] : heldRoleNames(subject, tenant, scopes, { rank: manifest.rank ?? [] }, now);
+	const rules = manifest.assignable;
 	return freezeDeep(compact({
 		v: 1,
 		issuedAt: rfc3339(now),
@@ -201,13 +307,21 @@ function buildLocalSnapshot(manifest, data, at) {
 		roles,
 		grants,
 		tenants: tenant === void 0 ? [] : [tenant],
+		assignable: tenant === void 0 || rules === void 0 ? void 0 : [localAssignableFor({
+			rules,
+			custom: manifest.custom,
+			tenant,
+			heldNames: roles,
+			held,
+			customRoles: tenantCustom
+		})],
 		scopes: manifest.scopes,
 		vocabulary: manifest.vocabulary
 	}));
 }
 /**
-* A snapshot source over the device's own membership rows (SQLite, a
-* PowerSync or Electric replica): offline, the UI guards answer from them.
+* A snapshot source over the device's own membership rows (SQLite, a PowerSync
+* or Electric replica): offline, the UI guards answer from them.
 */
 function localSnapshot(options) {
 	return compact({
@@ -223,7 +337,10 @@ function isColumns(roles) {
 function quoted(name) {
 	return `"${name.replaceAll("\"", "\"\"")}"`;
 }
-/** The synced tables `rows` names, each read whole: the subject streams sync only the user's own rows. */
+/**
+* The synced tables `rows` names, each read whole: the subject streams sync
+* only the user's own rows.
+*/
 function rowTables(rows) {
 	const tables = /* @__PURE__ */ new Set();
 	const column = (item) => {
@@ -258,7 +375,10 @@ function isSet(row, column) {
 function rowsOf(tables, table) {
 	return (tables[table] ?? []).filter(isRecord);
 }
-/** The value a column holds, read through its referenced table or map; `undefined` for none. */
+/**
+* The value a column holds, read through its referenced table or map;
+* `undefined` for none.
+*/
 function columnValue(row, column, tables) {
 	const raw = text(row[column.column]);
 	if (raw === void 0) return;
@@ -335,7 +455,10 @@ function customRoleOf({ key, grants, includes }) {
 		id: key.id
 	});
 }
-/** Custom roles from the custom-role rows: a tenant role, a shared role (no tenant) or a global role. */
+/**
+* Custom roles from the custom-role rows: a tenant role, a shared role (no
+* tenant) or a global role.
+*/
 function customRolesOf(permissions, includes) {
 	const roles = /* @__PURE__ */ new Map();
 	const entry = (key) => {
@@ -371,7 +494,10 @@ function customRolesOf(permissions, includes) {
 	}
 	return [...roles.values()].map(customRoleOf);
 }
-/** The user's memberships, global roles and custom roles from the rows of the tables `rows` names. */
+/**
+* The user's memberships, global roles and custom roles from the rows of the
+* tables `rows` names.
+*/
 function readRows(rows, tables, principal) {
 	const { id: user, tenant, attributes } = principal;
 	const memberships = rows.memberships.flatMap((source) => membershipsOf(source, tables, user));
@@ -412,11 +538,10 @@ function planOf(options) {
 * A `localSnapshot` source over a PowerSync database: `get` runs every query
 * with `db.getAll`, and a `db.watch` per query reports changes. Without
 * `queries` and `read`, it reads the tables `manifest.rows` names: the
-* memberships of every source with null roles dropped, the global roles and
-* the custom roles with their levels. A watch
-* result with unchanged content re-renders nothing (`connectSource`). The source
-* takes the database as an argument; `permdock/react-native` never imports
-* `@powersync/*`.
+* memberships of every source with null roles dropped, the global roles and the
+* custom roles with their levels. A watch result with unchanged content
+* re-renders nothing (`connectSource`). The source takes the database as an
+* argument; `permdock/react-native` never imports `@powersync/*`.
 */
 function powerSyncSource(db, options) {
 	const plan = planOf(options);
@@ -525,7 +650,10 @@ function guardStorage(storage) {
 		fail
 	};
 }
-/** `undefined` when the storage answers asynchronously; any failure reads as empty. */
+/**
+* `undefined` when the storage answers asynchronously; any failure reads as
+* empty.
+*/
 function readStoredSync(storage, subjectId, signed) {
 	if (subjectId === null) return NOTHING;
 	const raw = storage.read(SNAPSHOT_KEY);
@@ -562,8 +690,8 @@ function contentKey(snapshot) {
 	});
 }
 /**
-* Whether a source read changes nothing: same content as the snapshot the
-* store holds, and the store already settled on it.
+* Whether a source read changes nothing: same content as the snapshot the store
+* holds, and the store already settled on it.
 */
 function unchanged(store, next) {
 	if (typeof next === "string" || store.get().status() === "stale") return false;
@@ -575,9 +703,9 @@ function unchanged(store, next) {
 }
 /**
 * Hydrates `store` from `source` now, on every change it reports and on each
-* return to the foreground. Only the latest read applies; a read with
-* unchanged content re-renders nothing, and a failed read keeps the current
-* snapshot. Returns the unsubscribe.
+* return to the foreground. Only the latest read applies; a read with unchanged
+* content re-renders nothing, and a failed read keeps the current snapshot.
+* Returns the unsubscribe.
 */
 function connectSource(store, source, subscribeForeground) {
 	let active = true;
@@ -585,8 +713,8 @@ function connectSource(store, source, subscribeForeground) {
 	const pull = () => {
 		seq += 1;
 		const mine = seq;
-		Promise.resolve().then(() => source.get()).then((next) => {
-			if (active && mine === seq && !unchanged(store, next)) store.replace(next);
+		Promise.resolve().then(() => source.get()).then((snapshot) => {
+			if (active && mine === seq && !unchanged(store, snapshot)) store.replace(snapshot);
 		}, () => void 0);
 	};
 	pull();
@@ -642,7 +770,8 @@ function nativeStore(options) {
 		passCache: true,
 		onSnapshot: options.onSnapshot,
 		onClear: options.onClear,
-		approvalInterval: options.approvalInterval
+		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn
 	}), snapshot, {
 		server: false,
 		stale: revalidates && (fromStorage !== void 0 || waiting),
@@ -696,6 +825,7 @@ function PermDockProvider(props) {
 		onSnapshot: live.onSnapshot,
 		onClear: live.onClear,
 		approvalInterval: props.approvalInterval,
+		refreshOn: props.refreshOn,
 		previous: shown.current ?? void 0
 	})), [
 		props.storage,
@@ -737,9 +867,9 @@ function PermDockProvider(props) {
 		const refresh = () => {
 			if (inFlight || !online) return;
 			inFlight = true;
-			store.get().refresh().catch(() => void 0).finally(() => {
+			store.get().refresh().finally(() => {
 				inFlight = false;
-			});
+			}).catch(() => void 0);
 		};
 		const startTimer = () => {
 			if (typeof mode === "number" && timer === void 0) timer = setInterval(refresh, mode * 1e3);
@@ -793,7 +923,10 @@ function PermDockProvider(props) {
 }
 //#endregion
 //#region src/react-native/storage-adapters.ts
-/** SecureStore warns above 2048 bytes and may refuse larger values on some devices. */
+/**
+* SecureStore warns above 2048 bytes and may refuse larger values on some
+* devices.
+*/
 const SECURE_STORE_CHUNK_BYTES = 2048;
 const INDEX_PREFIX = "permdock-chunks:";
 function utf8Length(char) {
@@ -828,9 +961,9 @@ function chunkKey(key, index) {
 	return `${key}.${index}`;
 }
 /**
-* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
-* of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
-* is written last, so an interrupted write reads as absent.
+* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks of
+* at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and is
+* written last, so an interrupted write reads as absent.
 */
 function secureStoreStorage(store, options) {
 	const removeChunks = async (key, from, to) => {
@@ -863,7 +996,10 @@ function secureStoreStorage(store, options) {
 		}
 	};
 }
-/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+/**
+* A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the
+* first frame already has the snapshot.
+*/
 function mmkvStorage(mmkv) {
 	return {
 		getItem: (key) => mmkv.getString(key) ?? null,
@@ -879,8 +1015,8 @@ function mmkvStorage(mmkv) {
 //#endregion
 //#region src/react-native/subscriptions.ts
 /**
-* `subscribeForeground` over `AppState`: `active` returns to the foreground
-* and `background` leaves it. iOS `inactive` (a system sheet over the app) is
+* `subscribeForeground` over `AppState`: `active` returns to the foreground and
+* `background` leaves it. iOS `inactive` (a system sheet over the app) is
 * neither.
 */
 function appStateForeground(appState) {
@@ -894,11 +1030,14 @@ function appStateForeground(appState) {
 		};
 	};
 }
-/** `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as online. */
+/**
+* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+* online.
+*/
 function netInfoOnline(netInfo) {
 	return (listener) => netInfo.addEventListener((state) => {
 		listener(state.isConnected !== false && state.isInternetReachable !== false);
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{refs-CNJBiTFo.js → refs-C8BKxc_e.js}

@@ -1,5 +1,5 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-CUvURzHp.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;

package/dist/{relation-walk-3OyDBF0S.js → relation-walk-DK_gkgL7.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { n as relationId } from "./relations-BnCWnJGI.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { n as relationId } from "./relations-BxvRvDHK.js";
 //#region src/core/relation-walk.ts
 /** Whether the holder's period covers `now`. */
 function activeNow(holder, now) {
@@ -53,7 +53,10 @@ function restrictedAbove(condition, row, reader) {
 	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
 	return false;
 }
-/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
+/**
+* The instances a graph relation reads: the start, then ancestors until a
+* restricted one or `depth`.
+*/
 function relationWalk(condition, row, reader) {
 	if (!isRecord(row)) return;
 	const first = relationId(ownGet(row, condition.field));
@@ -93,10 +96,10 @@ function relationWalk(condition, row, reader) {
 	};
 }
 /**
-* Whether the subject holds the relation on the row's instance or an
-* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
-* goes on past `depth` with no holder below it. Any read the instance could
-* not answer is `relation-unavailable` unless a holder was found elsewhere.
+* Whether the subject holds the relation on the row's instance or an ancestor
+* within `depth`. A cycle is `relation-depth`; so is a chain that goes on past
+* `depth` with no holder below it. Any read the instance could not answer is
+* `relation-unavailable` unless a holder was found elsewhere.
 */
 function resolveRelated(condition, row, subject, now, reader, permitted) {
 	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
@@ -148,8 +151,8 @@ function groupKey(group) {
 }
 /**
 * Whether the principal holds `at.relation` on one instance, directly or
-* through a group whose members hold it. Groups of `at`'s own resource nest
-* at most `budget` deep; a group of another resource gets a fresh budget
+* through a group whose members hold it. Groups of `at`'s own resource nest at
+* most `budget` deep; a group of another resource gets a fresh budget
 * (declarations rule out cycles across resources). A group met twice on one
 * path, or one past the budget, is `relation-depth`. `explored` holds the
 * budget each group was walked with across the whole walk: a group already

package/dist/{relations-BnCWnJGI.js → relations-BxvRvDHK.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as idText } from "./expiry-D4_YKRKD.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { a as expandRelation } from "./resource-relations-D_jw0BFx.js";
+import { i as idText } from "./expiry-6XByK0dm.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { a as expandRelation } from "./resource-relations-8-pCScBO.js";
 //#region src/core/relations.ts
 function isInstant(value) {
 	return value === void 0 || typeof value === "number" && Number.isFinite(value);

package/dist/{replay-Du1tJjG7.js → replay-BU09ad4L.js}

@@ -1,4 +1,4 @@
-import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { o as epochSeconds } from "./time-nR1JesoH.js";
 //#region src/ssf/replay.ts
 function memoryReplayStore() {
 	const seen = /* @__PURE__ */ new Map();

package/dist/{replay-DCDD_ZfL.d.ts → replay-DNftIb_R.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-cTos-H7p.js";
+import { l as ReplayStore } from "./types-DjuMBNF9.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-BykKLmyE.js → request-context-C25ilqiJ.js}

@@ -1,10 +1,10 @@
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
-import { t as buildInstance } from "./build-instance-DxE7czo9.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { t as buildInstance } from "./build-instance-CNWaYJyr.js";
 //#region src/core/request-context.ts
 /**
-* Errors an adapter raises around one instance (a `context` hook that threw,
-* an `onDenied` that failed), fed to the instance's `on('error')` handlers and
+* Errors an adapter raises around one instance (a `context` hook that threw, an
+* `onDenied` that failed), fed to the instance's `on('error')` handlers and
 * replayed to later ones, as core replays its own.
 */
 function deliver(handler, error) {
@@ -33,9 +33,9 @@ function errorChannel(queued) {
 	};
 }
 /**
-* `buildInstance` with an error channel: the instance's `on('error')`
-* replays `errors` raised while resolving the request, and `report` adds
-* more. Kept beside `errorChannel`, so adapters without one do not bundle it.
+* `buildInstance` with an error channel: the instance's `on('error')` replays
+* `errors` raised while resolving the request, and `report` adds more. Kept
+* beside `errorChannel`, so adapters without one do not bundle it.
 */
 async function buildReportingInstance(input) {
 	const channel = errorChannel(input.errors);

package/dist/{request-schema-CMreVuFM.js → request-schema-DhX7UbfQ.js}

@@ -1,5 +1,8 @@
 //#region src/approvals/request-schema.ts
-/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
+/**
+* An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no
+* `format`.
+*/
 const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
 const STRINGS = {
 	type: "array",